Documented steps

Single hop, one-off: run `ssh -J <bastion_user>@<bastion_host>:<bastion_port> <user>@<target_host>`. ssh first makes an SSH connection to the jump host, then establishes a TCP forwarding to the target from there, and you land in a shell on <target_host>.
Multi-hop: separate jump hosts with commas in visiting order, e.g. `ssh -J <user1>@<jump1>,<user2>@<jump2> <user>@<target_host>`. Hosts are visited sequentially left to right; IPv6 addresses in the list must be enclosed in square brackets.
Persist the setting instead of typing -J each time: add to ~/.ssh/config: `Host <target-alias>` / ` HostName <target_host>` / ` User <user>` / ` ProxyJump <bastion_user>@<bastion_host>`. Then simply run `ssh <target-alias>`.
Remember that configuration directives supplied on the command line generally apply to the destination host, not the jump host(s); put jump-host-specific options (identity file, port, user) in a separate Host stanza in ~/.ssh/config matching the jump host's own alias.
Verify the hop path if unsure: add `-v` and inspect the debug output to confirm which jump host(s) ssh connected through before reaching the target.

Known gotchas

-J is a command-line shortcut for the ssh_config ProxyJump directive; setting ProxyJump's host value to 'none' disables it entirely. Docs: https://man.openbsd.org/ssh.1 , https://man.openbsd.org/ssh_config.5
ProxyJump requires the jump host(s) to be running sshd; unlike some ProxyCommand recipes, no external nc/netcat binary is needed since ssh performs the TCP forwarding to the destination itself.
Multiple jump hosts are comma-separated and visited sequentially (first hop first); per-host command-line options do not apply to the jump hosts, only to the final destination -- configure jump hosts via ~/.ssh/config instead.
scp and sftp also accept -J for the same purpose, since both use ssh underneath for the transport connection.

Set up an ad hoc encrypted SOCKS proxy through an SSH server with ssh -D, then route arbitrary client traffic (browsers, curl, etc.) through it so requests appear to originate from the remote host.

openssh.com · 6 steps · unrated

Reach a service that is only accessible from a remote host (e.g. a database bound to localhost on a remote server) by forwarding a local TCP port through an SSH tunnel to that remote-only service using ssh -L.

openssh.com · 6 steps · unrated

Give your agent this knowledge — and 17,100+ more routes

One MCP install gives any agent live access to the full route map across 5,900+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Connect to a private server that is only reachable through an intermediate bastion/jump host, using SSH ProxyJump so the client transparently tunnels through one or more hops.

Documented steps

Known gotchas

Related routes

Give your agent this knowledge — and 17,100+ more routes

Need this verified for your stack — or a route we don't have yet?